CVE catalog

CVE-2018-15756

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Oct 16, 2018, 12:00:00 AM UTC
Updated: Aug 25, 2026, 4:28:27 PM UTC
Source: [NVD] · [CVE record]
EPSS: 9.21% · Oct 25, 2026

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libspring-java	sid	`4.3.30-6`	fixed
Debian	libspring-java	forky	`4.3.30-6`	fixed
Debian	libspring-java	trixie	`4.3.30-3`	fixed
Debian	libspring-java	bookworm	`4.3.30-2`	fixed
Cpe	spring_framework	Not reported	Not reported	unknown
Cpe	spring_framework	Not reported	`5.0.10`	fixed
Cpe	agile_product_lifecycle_management	Not reported	Not reported	unknown
Cpe	agile_product_lifecycle_management	Not reported	Not reported	unknown
Cpe	agile_product_lifecycle_management	Not reported	Not reported	unknown
Cpe	communications_brm_-_elastic_charging_engine	Not reported	Not reported	unknown
Cpe	communications_converged_application_server_-_service_controller	Not reported	Not reported	unknown
Cpe	communications_diameter_signaling_router	Not reported	Not reported	unknown
Cpe	communications_diameter_signaling_router	Not reported	Not reported	unknown
Cpe	communications_diameter_signaling_router	Not reported	Not reported	unknown
Cpe	communications_element_manager	Not reported	Not reported	unknown
Cpe	communications_element_manager	Not reported	Not reported	unknown
Cpe	communications_online_mediation_controller	Not reported	Not reported	unknown
Cpe	communications_session_report_manager	Not reported	Not reported	unknown
Ubuntu	libspring-java	pro	`3.2.13-3`	vulnerable
Ubuntu	libspring-java	pro	`3.2.13-4`	vulnerable
Ubuntu	libspring-java	pro	`3.2.13-5`	vulnerable
Ubuntu	libspring-java	pro	`3.2.13-5ubuntu0.1~esm1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libspring-java	source	sid	`4.3.21-1`	not yet assigned	Not reported	[911786]
Debian	libspring-java	source	forky	`4.3.21-1`	not yet assigned	Not reported	[911786]
Debian	libspring-java	source	trixie	`4.3.21-1`	not yet assigned	Not reported	[911786]
Debian	libspring-java	source	bookworm	`4.3.21-1`	not yet assigned	Not reported	[911786]
Cpe	spring_framework	cpe	Not reported	`5.0.10`	Not reported	NVD-CVE-2018-15756	Not reported

[Debian bug #911786]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libspring-aop-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-beans-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-context-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-context-support-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-core-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-expression-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-instrument-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-jdbc-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-jms-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-messaging-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-orm-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-oxm-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-test-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-transaction-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-web-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-web-portlet-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
[libspring-web-servlet-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12
- 4.3.30-2 · all · bookworm
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · bookworm; nvd · libspring-java · debian · 12

[Debian 13 (Trixie)]

[libspring-aop-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-3 · all · trixie
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · 13
- 4.3.30-3 · all · trixie
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · 13
[libspring-beans-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-3 · all · trixie
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · 13
- 4.3.30-3 · all · trixie
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · 13
[libspring-context-java]Fixed
Source package: [libspring-java]
Details (2)
- 4.3.30-3 · all · trixie
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · 13
- 4.3.30-3 · all · trixie
  Fixed · Fixed: 4.3.21-1
  nvd · libspring-java · debian · 13

Next results

Observed: Oct 23, 2026, 5:34:58 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]